CVE-2026-44378: CWE-407: Inefficient Algorithmic Complexity in randombit botan
CVE-2026-44378 is a medium severity vulnerability in the Botan C++ cryptography library prior to version 3.12.0. It involves inefficient algorithmic complexity in parsing certain indefinite length BER encodings, which can cause quadratic parsing behavior leading to denial of service. The vulnerability arises because Botan accepted indefinite length encodings in structures that should be DER encoded, which prohibits such encodings. This issue is fixed in Botan version 3.12.0.
AI Analysis
Technical Summary
Botan versions before 3.12.0 contain a vulnerability (CWE-407) where the parser exhibits quadratic time complexity when processing specific indefinite length BER encodings. These encodings are not compliant with DER encoding rules but were still accepted by Botan, allowing crafted inputs to cause denial of service by excessive resource consumption. The vulnerability is addressed in version 3.12.0 of Botan.
Potential Impact
An attacker can cause a denial of service by submitting specially crafted BER encoded data that triggers quadratic parsing behavior in affected Botan versions. This results in excessive CPU consumption and potential service disruption. There is no indication of privilege escalation, data disclosure, or code execution from this vulnerability.
Mitigation Recommendations
This vulnerability is fixed in Botan version 3.12.0. Users should upgrade to version 3.12.0 or later to remediate this issue. Patch status is not explicitly stated beyond the fix in 3.12.0, so verify with the vendor advisory for the latest remediation guidance.
CVE-2026-44378: CWE-407: Inefficient Algorithmic Complexity in randombit botan
Description
CVE-2026-44378 is a medium severity vulnerability in the Botan C++ cryptography library prior to version 3.12.0. It involves inefficient algorithmic complexity in parsing certain indefinite length BER encodings, which can cause quadratic parsing behavior leading to denial of service. The vulnerability arises because Botan accepted indefinite length encodings in structures that should be DER encoded, which prohibits such encodings. This issue is fixed in Botan version 3.12.0.
CVSS v4.0
Score 6.9medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Botan versions before 3.12.0 contain a vulnerability (CWE-407) where the parser exhibits quadratic time complexity when processing specific indefinite length BER encodings. These encodings are not compliant with DER encoding rules but were still accepted by Botan, allowing crafted inputs to cause denial of service by excessive resource consumption. The vulnerability is addressed in version 3.12.0 of Botan.
Potential Impact
An attacker can cause a denial of service by submitting specially crafted BER encoded data that triggers quadratic parsing behavior in affected Botan versions. This results in excessive CPU consumption and potential service disruption. There is no indication of privilege escalation, data disclosure, or code execution from this vulnerability.
Mitigation Recommendations
This vulnerability is fixed in Botan version 3.12.0. Users should upgrade to version 3.12.0 or later to remediate this issue. Patch status is not explicitly stated beyond the fix in 3.12.0, so verify with the vendor advisory for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-05T20:15:20.631Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a172e7be29bf47b50d78a43
Added to database: 05/27/2026, 17:48:43 UTC
Last enriched: 06/03/2026, 20:57:52 UTC
Last updated: 07/26/2026, 20:52:04 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.